Data-processing addendum

1. Parties, scope, and instructions

This is a review draft, not an executed data-processing agreement. An order form must identify the customer and operator’s legal names and addresses. The customer generally acts as controller or equivalent responsible organization for workspace content; the operator acts as processor/service provider to the extent it processes that content on documented instructions.

Northstone is powered by Loomlogic (loomlogic.io).

The subject matter is providing the subscribed workspace. The duration is the service term plus an approved return/deletion period. Processing includes collection, storage, organization, retrieval, customer-authorized communication, explanation, and deletion. Data subjects may include authorized users, customer contacts, transaction participants, and other people whose information is lawfully supplied. Data categories follow the privacy notice and the completed customer processing schedule.

2. Proposed processor duties

The final agreement should require the operator to:

• Process customer personal information only on documented lawful instructions, including instructions about international transfers, unless legally required otherwise; notify the customer where legally permitted.
• Restrict personnel access to authorized duties and bind personnel to confidentiality.
• Maintain appropriate technical and organizational safeguards proportionate to the risk and document the actual security schedule.
• Assist the customer with rights requests, incidents, impact assessments, and regulator inquiries to the extent relevant to the service.
• Notify the customer without undue delay after becoming aware of a personal-data breach; contractually agree the escalation contact and practical reporting target without replacing statutory deadlines.
• Do not sell customer personal information, share it for cross-context behavioral advertising, or use it for unrelated purposes. Include applicable California service-provider restrictions and required rights to monitor and remediate.
• Notify the customer if an instruction appears to infringe applicable data-protection law, and allow appropriate compliance information and proportionate audits under agreed safeguards.

3. Security schedule and incidents

The approved schedule must describe tenant isolation, identity and permission controls, transport and storage protections, privileged access, logging, change management, backups, recovery, and vulnerability handling. Verify deployed controls rather than attaching unsupported encryption, certification, uptime, or residency claims.

Incident communications should identify the known nature, affected data and people where available, likely consequences, containment, mitigation, and contact. Initial notice may be followed by updates. Preserve incident evidence under a documented hold; do not disclose another customer’s information during an audit.

4. Subprocessors and transfer schedule

Attach the actual approved provider list with entity, function, country/region, onward recipients where relevant, and contractual safeguards. Define prior specific or general written authorization, change notice, a meaningful objection process, and responsibility for subprocessor performance. A list of integrations in a settings screen is not an approved subprocessor register.

Complete required Québec transfer impact assessments and written agreements before out-of-Québec disclosure. For restricted GDPR transfers, attach the applicable mechanism and supplementary measures. Standard contractual clauses require completed parties, modules, annexes, and assessment; this webpage is not an executed SCC instrument.

5. Customer responsibilities

The customer provides lawful instructions, appropriate notices and bases or consent, valid content and feed permissions, proportionate data, and accurate access permissions. It handles its own professional and regulatory recordkeeping. The operator’s obligations do not excuse unlawful customer instructions.

Document and approve each AI use and communication channel before activation. No shared-model-training license or autonomous eligibility use is granted by this draft. Independent operator processing, such as account security, must be covered by its own notice and lawful basis.

6. Return, deletion, and evidence

At the end of processing, return or delete customer personal information at the customer’s choice, subject to applicable retention law and agreed backup handling. Define the export format, window, deletion timing, derived-data handling, provider deletion, backup expiry, and evidence of completion in the final schedule.

Current retention automation is not implemented. A signed promise must be matched to an approved operational process and verified deletion controls. Preserve only documented exceptions, restrict retained data, and communicate the scope of any legal hold.

7. Completion and execution

Request a completed processing schedule through support@loomlogic.io. Before execution, finalize the parties, region-specific clauses, provider schedule, security annex, retention/deletion schedule, audit process, liability terms, and authorized signatures. This draft is not incorporated into a contract merely by being linked in the footer.